Traefik HTTP/3 Read/Idle Timeout Not Applied (CVE-style advisory)

Key Vulnerability Information Summary Vulnerability Overview Type: Under the HTTP/3 protocol, when a client does not send a header, there is an issue where the read timeout and idle timeout are not correctly enforced by the server when reading the request body. Manifestation: If the request body length is unknown (no ), the server may experience hung connections or abnormal resource usage because the timeout configurations are not properly applied. Affected Scope Affected Components: The HTTP/3 (QUIC) entry point (code related to ) in . Trigger Condition: In an HTTP/3 request where (i.e., no header). Impact: May cause the timeout control during the request body reading phase to fail, affecting service availability and resource management. Fix Solution In , for the HTTP/3 request body reading logic, explicitly set the read timeout and idle timeout: - Through the / configuration items of , ensure that timeouts are correctly applied when . - In the fix commit , the timeout parameters for were adjusted to ensure the timeout mechanism takes effect in HTTP/3 scenarios. POC / Exploitation Code ```go // Test case: TestHTTP3ReadTimeout func TestHTTP3ReadTimeout(t testing.T) { certContent, err := localhostCert.Read() require.NoError(t, err) keyContent, err := localhostKey.Read() require.NoError(t, err) tlsCert, err := tls.X509KeyPair(certContent, keyContent) require.NoError(t, err) epConfig := static.EntryPointsTransport() epConfig.SetDefaults() epConfig = static.EntryPointsTransport() epConfig.RespondingTimeouts.ReadTimeout = ptypes.Duration(300 time.Millisecond) entryPoint := NewEntryPoint(t.Context(), static.EntryPoint{ Address: "127.0.0.1:8081", Transport: epConfig, ForwardedHeaders: static.ForwardedHeaders(), HTTP: static.HTTPConfig(), HTTP2: static.HTTP2Config(), HTTP3: static.HTTP3Config(), }, nil) require.NoError(t, err) router, err := trooper.NewRouter() require.NoError(t, err) bodyReader := make(chan error, 1) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.DefaultTLSConfig()) router.AddHTTP3Config("example.com", &tls.Config{ Certificates: []tls.Certificate{tlsCert}, }, traefik.D

Goal Reached Thanks to every supporter — we hit 100%!

Traefik HTTP/3 Read/Idle Timeout Not Applied (CVE-style advisory)

More from this source